ML20217F825

Forwards,For Review & Comment,Copy of Preliminary ASP of Operational Event Which Occurred at TMI Unit 1 on 970621 & Reported in LERs 289/98-007,008 & 010

ML20217F825
Person / Time
Site:	Three Mile Island
Issue date:	03/30/1998
From:	Colburn T NRC (Affiliation Not Assigned)
To:	Langenbach J GENERAL PUBLIC UTILITIES CORP.
References
NUDOCS 9804010147
Download: ML20217F825 (18)

Text

.P &f 2 res g \ UNITED STATES g j - NUCLEAR REGULATORY COMMISSION WASHINGTON. D.C. 30006 0001 p\ *****/ March 30, 1998 [pdf7 Mr. James W. Langenbach, Vice President and Director- TMI-1 GPU Nuclear Corporaibn P.O. Box 480 Middletown, PA 17057

SUBJECT:

REVIEW OF PRELIMINARY ACCIDENT SEQUENCE PRECURSOR ANALYSIS OF OPERATIONAL EVENT AT THREE MILE ISLAND NUCLEAR STATION, UNIT NO.1

Dear Mr. Langenbach:

Enclosed for your review and comment is a copy of the preliminary Accident Sequence Precursor (ASP) analysis of an operational event which occurred at the Three Mile Island Nuclear Station, Unit 1, on June 21,1997 (Enclosure 1), and was reported in Licensee Event Report (LER) Nos.

289/97-007, -006, and -010. This analysis was prepared by our contractor at the Oak Ridge National Laboratory. The results of this preliminary analysis indicate that this event is an accident sequence precursor for 1997. In assessing operational events, an effort was made to make the ASP models as realistic as possible regarding the specific features and response of a given plant to various accident sequence initiators. We realize that licensees may have additional systems and emergency procedures, or other features at their plaints that might affect the analysis. Therefore, we are providing you an opportunity to review and comment on the technical adequacy of the preliminary ASP analysis, including the depiction of plant equipment and equipment capabilities. Upon receipt and evaluation of your comments, we will revise the conditional core damage probability calculations where necessary to consider the specific

- information you have provided. The object of the review process is to provide as realistic an analysis of the significance of the event as possible.

In order for us to incorporate your comments, perform any required reanalysis, and prepare the final report of our anaysia of this event in a timely manner, you are requested to complete your review and to provlje any comments within 30 days of receipt of this letter. We have streamlined the ASP Program with the objective of significantly improving the time after an event in which the final precursor analysis of the event is made publicly available. As soon as our final analysis of the event has been completed, we will provide to you the final precursor analysis of the event and the resolution of your comments.

We have also enclosed severalitems to facilitate your review. Enclosure 2 contains specific guidance for performing the requested review. It also identifies the criteria that we will apply to determine whether any credit should be given in the analysis for the use of licensee-identified additional equipment or specific actions in recovering from the event, and describes the specific information that you should provide to support such a claim. Enclosure 3 consists of copies of LER Nos. 289/97-007, -008, and -010, which documented the event.

h 9904010147 980330 PDR ADOCK 05000289 S PDR NRC m.E CEMIS C

7 i

.o J.' Langenbach Please contact me at (?O1) 415-1402 if you have any questione regardmg this request. This j request is covered by the existing OMB clearance number (31660-0104) for NRC staff follow up i review of events documented in LERs. Your response to this request is voluntary and does not constitute a licensing requirement.

Sincerely, Original signed by T: mothy G. Colbum, Senior Project Manager Project Directorate 1-3 Division of Reactor Projects - t/11 Office of Nuclear Reactor Regulation Docket No. 50-289

Enclosures:

1. ASP Analysis of Operational Event

2. Specific Guidance Requested Review

3. Licensee Eveni Reports .

cc w/encis' See next psge DISTRIBUTION g Docket File +

PUBLIC PDI-3 r/f J Zwolinski TColbum TClark OGC ACRS C. Hehl, RI DOCUMENT NAME: G:\COLBURN\TMl197ST.WPD

. To receive a copy of this document, indicate in the box: "C" = Copy without attachment / enclosure "E" = Copy with ctt chment/ enclosure "N"= No' copy OFFICE PDl-3/PM l PDI-3/LA2 , j ()- l6 PD}3/D J' '

I NAME TColbum P TClark(MO N ,

DATE 03/ 2 /98 03/JG /98" W3ffo/98 OFFICIAL RECORD COPY

Z 9

J.Langenbarh Three Mile Island Nuclear Station, Unit No.1 cc:

Michael Ross Robert B. Borsum Director, O&M, TMI B&W Nuclear Technologies GPU Nuclear Corporation Suite 525 '

P.O. Box 480 1700 Rockville Pike Middletown, PA 17057 Rockville, MD 20852 John C. Fomicola William Domsife, Acting Director -

Director, Planning and Bureau of Radiation Protection Regulatory Affairs Pennsylvania Department of GPU Nuclear Corporation Environmental Resources 100 Interpace Parkway P.O. Box 2063 Parsippany, NJ 07054 Harrisburg, PA 17120 Jack S. Wetmore Dr. Judith Johnsrud Manager, TMl Regulatory Affairs National Energy Committee GPU Nuclear Corporation Sierra Club P.O. Box 480 433 Orlando Avenue Middletown, PA 17057 State College, PA 16803 Emest L. Blake, Jr., Esquire Peter W. Eselgroth, Region i Shaw, Pittman, Potts & Trowbridge U.S. Nuclear Regulatory Commission 2300 N Street, NW. 475 Allendale Road Washington, DC 20037 King of Prussia, PA 19406 Chairman Board of County Commissioners of Dauphin County Dauphin County Courthouse Harrisburg, PA 17120 Chairman Board of Supervisors of LondonderryTownship R.D. f1, Geyers Church Road Middletown, PA 17057 Wayne L Schmidt Senior Resident inspector (TMI-1)

U.S. Nuclear Regulatory Commission P.O. Box 311 Middistown, PA 17057 Regional Administrator Region i U.S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, PA 19406

~T 8

LER Nos. 289/97-007,-008 -010 LER Nos. 289/97-007,-008,-010 Event

Description:

Failure of both generator output breakers capws a LOOP Date of Event: June 21,1997 Plant: Three Mile Island, Unit 1 Event Siammary 1hree Mile Island, Unit 1 (TMI 1) was at 100% power when the plant experienced a loss of offsite power (LOOP) aAer both generator output breakers in the 230-kV substatior failed.' The LOOP resulted in an immediate trip of both the reactor and the turbine; plant computer data indicated that the trip insertion times .

were excessive for four control inds.2 Both emergency diesel generators (EDGs) started and loaded as I designed. Offsite power was restored within 90 min. 'Ihe unit was cooled by natural circulation cooling until

~offsite power was restored. It was subsequently discovered that the pressurizer power-operated relief valve g (PORV) was failed closed during this event (see Additional Event-Related Information section).Ihe aded conditional core damage probability (CCDP) for this plant-centered LOOP is 9.6 x 104 Event Description .

TMI 1 was at 100% power aAer almost 617 days of continuous operation. On June 21,1997, the B phase of the 230-kV power transformer developed a fault causing severe overheating and the subsequent ejection of the bushing and conductor from the breaker housing of output breaker GBI-02 (Fig.1). This resulted in a fault being detected on 230-kV bus 4. The parallel generator breaker, GBI 12, opened because of the detected fault on 230-kV bus 4. Breaker GBI-12 subsequently suffered a re-stnke, which damaged the B phase of this breaker, causing a fault on 230-kV bus 8. Automatic breaker action because of both faults isolated electric power to the station resulting in a LOOP.'

1he LOOP caused an immediate reactor trip and turbine trip. The plant computer captured times associated with each control rod reachmg the 25% zone reference as the reactor trip occurred. A review of the data  ;

showed that four control rods exceeded the trip insertion time limit of 1.66 s for % msertion. Personnel attributed the slow insertion times to reduced clearances in the old style control rod drive thermal barriers because of the presence of deposits on the internal check valves, between the thermal barrier bushmg, and on the leadscinw. All L. ntrol rods inserted to the % insertion position within 2.2 s. The licensee determmed that there would be no aJ erse effects associated with control rod insertion times as high as 3.0 s (Ref. 2).

Both EDGs started and loaded onto their respective safeguards bus as designed. Nonvital loads, including circulating water and main condenser vacuum pumps, were not energtzed The reactor coolant pumps were also without power. Natural circulation was verified in the reactor coolant system within 19 min followmg the trip and LOOP. Decay heat removal was estat,lished using the emergency foodwater (EFW) system and the steam generator atmospheric dump valves. Offsite power was restored within 90 min aAer the breaker failures.

1 Enclosure 1

_9

r o'

, *l LER Nos. 289/97-007 -008. -010 AAer operators established the main %= heat sink, the reactor coolant pumps were restarted, returning i the reactor coolant system to forced circulation cooling.'

Additional Event-Related Information TMI 1 has a single PORV installed on the pressurizer that is replaced with a spare PORV during each refueling outage. The licensee discovered that during the previous refueling outage, the PORV was wired incorrectly and was subsequently inoperable for the entire operatmg cycle. 'Ihe PORV was failed in the closed position and would not have opened in response to an automatic (2,450 psig) or a manual signal.' The operating cycle -

completed with a failed PORV encompassed the LOOP event described by Refs. I and 2.

Besides the PORV, there are two safety relief valves connected to the pressurizer with a nommal relief setpoint of 2,500 psig. The shutoff head of the safety injection pumps is ~2,900 psig. Feed-and-bleed operation is possible with an inoperable PORV because the safety relief valves can be lifted with the head established by operstmg the safety injection pumps.'

TMI 1 has two dedicated EDGs (1 A and IB) to supply electric power to engineered safeguards buses ID and IE, respectively, in the event of a LOOP. Additionally, one EDG from TM12 is available as an alternate ac power source during a station blackout (SBO). The alternate EDG, which is manually started from the control room, can be aligned to either engineered safeguards bus 1D or iE within 10 min following an S BO. Operators must close two breakers and any desired loads must be manually loaded onto the bus selected to be re-energized.d Modeling Assumptions This combination of events was modeled as a plant centered LOOP. The probability of not recovering offsite power in the short term is included in the initiating event probability (IE-LOOP). Consequently, this term was set to the probability for a plant-centered LOOP assummg operators fail to recover offsite power in the short term (5.0 x 10-').

The probability of short-tenn and long-term offsite power recovery for a plant centered LOOP and the probability of an RCP seal loss-of-coolant accident (LOCA) following a postulated station blackout were developed based on data distributions contamed in NUREG-1032, Evaluation ofStation Blackout Accidents at Nuclear Power Plants.5 The RCP seal LOCA models were developed as part of the NUREG-1150 probabilistic risk assessment (PRA) effo:ts. Both models are described in RevisedLOOPRecoveryandPWR SealLOCA Models.' The probabilities for the followmg basic events are based on these models:

1. Initiatmg event-LOOP (IE-LOOP),

2. operator fails to recover offsite power within 2 h (OEP-XHE-NOREC-2H),

3. operator fails t-) recover offsite power within 6 h (OEP-XHE-NOREC-6H), i

4. operator fails to recover offsite power before battery depletion (OPE-XHE-NOREC-BD),

5. operator fails to recover offsite power before RCP seals fail (OPE-XHE-NOREC-SL), and '

i

.6. RCP seals fail without cooling and injection water (RCS -MDP-LK-SEALS).

1 l

l 1

'. t LER Nos. 289/97-007,-008.-010 he PRA for TMI I indicates that an SBO with a concurrent failure of EFW would lead to core damage in approximately 2 h (Ref. 7, Table B.1-11, page B.1-25). His indicates that substantial time is available for the recovery of electric power. Potential recovery actions were modeled by the #dition of a basic event (basic ever.t OEP-XHE-NOREC-SB) under the OP-SBO top event (OP-2H) on the Ih0P event tree (Fig. 2). Top event OP-SBO is substituted for the OP-2H top event whenever emergency power (EP) and EFW are failed.

The alternate EDG (from TMI 2) was added to the Integrated Reliability and Risk Analysis System (IRRAS) model for TMI 1. He probability that the alternate EDG faib to start and run (basic event EPS-DGN-FC-AAC) was set to the same value as the dedicated EDGs (4.2 x 104 ). In addition, because ,

operators must start and load the alternate EDG manually, a basic event was added to reflect the probability that the operator fails to start and load the alternate EDG (basic event EPS-XHE-XM-AAC). Basic event EPS-XHE-XM-AAC was set at 1.0 x 104 in accordance with sim4r human error probabilities already incorporated in the IRRAS model for TMI. De common-cause failure probability of the emergency power system for the base case was based on two EDGs. This was adjusted based on the availability of three EDGs and was developed based on data distributions contained in INEL-94-0064, Common-Cause Failure Data Collection and Analysis System (Ref. 8, Table 5-8: alpha factor distribution summary - fail to start, CCCG = 3, a33 = 0.0224; and Table 5-11: alpha factor distribution summary - fail to run, CCCG = 3, ag = 0.0232). Because a3 si equivalent to the p factor of the multiple Greek letter method used in the IRRAS models, the common-cause failure probability of the EDGs (basic event EPS-DGN-CF-ALL) wm adjusted from 1.6 x 10-8 based on two EDGs to 9.5 x 10" based on three EDGs.

De slow insertion of four reactor control rods was not considered in the model. De control rods inserted well within the time (3.0 s) that the licensee calculated to be limiting. Additionally, all but four control rods met the % insertion time prescribed by the Technical Specifications.

Because the PORV was inadvenently disabled during the operating cycle that encompassed the LOOP event, the probability that the PORV fails to open on demand (basic event PPR-SRV-CC-PORV) wm set to "TRUE" (i.e., will not open).' Two additional basic events were added to the IRRAS model to account for the availability of the safety reliefvalves to relieve any pressure buildup (basic events PPR-SRV-CC-1 A and PPR-SRV-CC-1B). De probability that a safety relief valve would fail to open when its setpoint was reached was set to the nommal failure rate for the PORV (see Table 1). Additionally, the operator would only need to verify the high pressure injection (HPI) pumps started in a situation that required feed-and-bleed cooling to remove decay heat; no other action regarding the PORV or the safety relief valves is required from the operators.

Therefore, the probability that the operator fails to initiate feed and-bleed cooling (basic event HPI-XHE-XM-4 HPICL) was reduced from 1.0 x 10 to 1.0 x 103 Analysis Results The CCDP for this event is 9.6 x 104. He dominant core damage sequence for this event (sequence 26 on Fig.

2) involves e a LOOP,

. a successful reactor trip, 3

l 1

1

c: ,

• ;t LER Nos. 289/97-007.-008.-010

. a failure of emergency power,

. . a successful initiation of emerBency feedwater,

+ no challenge to the PORV (failed) or pressurizer safety relief valves, a failure of the reactor coolant pump seals, and

- a failure to restore electric power before core damage.

This SBO sequence (sequence 26 on Fig. 2) accounts for 85% of the total contribution to the CCDP. The next most dominant sequence (sequence 41 on Fig. 2) contributes 11% to the total CCDP. This sequence involves an SBO, a failure of the EFW system, and a failure to recover any form of electrical power before the onset of core damage.

1 All of the most significant sequences involve an SBO. The nominal probability that a PORV is challenged duiing a LOOP or an SBO is 0.16 and 0.37, respectively, based on actual LOOP and SBO events. However, the PORV failure duninished those sequences where the PORV could potentially have lifted and then failed to rescat. Basic events PPR-SRV-CO-L and PPR-SRV-CO-SRO (defmed in Table 1) were set to 5.0 x 10-8and ,

5.4 x 10-', respectively (i.e., the PORV will not open, but the safety valves are challenged) based on Integrated l Plant Exammation (IPE) data. Because the safety relief valves have a higher set point than the PORV, they l may or may not have lifted in place of the PORV. However, the safety valves were assumed to lift during feed-and-bleed operation.

Defmitions anil probabilities for selected basic events are shown in Table 1. The conditional probabilities associated wid the highest probability sequences are shown m Table 2. Table 3 lists the sequence logic associated with the sequences listed in Table 2. Table 4 describes the system names associated with the dommant sequences. Minimal cut sets associated with the <tamiamat sequences are shown in Table 5.

Acronyms CCDP conditional core damage probability CDP core damage probability EDG emergency dieselgenerator EFW emergency feedwater system i HPI high-pressure injection IPE integrated plant exammation IRRAS Integrated Reliability and Risk Analysis System LOOP loss ofoffsite power MOV motor operated valve PORV power operated reliefvalve I PRA probabilistic risk assessment RCP reactor coolant pump .

SBO I staten blackout SGTR_ steam generator tube rupture SLOCA smallloss of-coolant accident TRANS transient event 4

~?

LER Nos. 289/97-007,-008,-010 i

References 1 LER 289/97-007, Rev. O," Generator Output Breaker Failure Resulting in a loss of Off-Site Power and Reactor Trip," July 21,1997.

1

2. LER 289/97-008, Rev. O, " Control Rod Trip Insertion Tunes Exceed TS Section 4.7.1.1 Limits," July 21, 1997.

l

3. LER 289/97-010, Rev. O, " Pilot Operated Relief Valve (PORV) Inoperability Due to Being Mis-Wired {

and Failure to Perform Post-Maintenance Test (PMT) Following Replacement During 11R Refueling Outage," November 12,1997.

4. Three Mile Island, FinalSafety Analysis Report (Updated Version).

5. Evaluation of&ation Blackout Accidents at Nuclear Power Plants, NUREG-1032.

6. RevisedLOOP RecoveryandPWR SealLOCA Models, ORNIJNRCILTR-89111, August 1989.

7, Three Mile Island Unit 1, Probabilistic Risk Assessment (Level 1), Dec~nber 1992.

8. Marshall and Rasmuson, Common-Cause Failure Data Collection andAnalysis System, INEL-94/0064, December 1995.

5

g LER Nos. 289/97-007,-008,-010

1Aour

1. 8 230 Wbus transformer

Unit 2 Ce12 109102 109202 1B-02 k bdfelown IA Juncton b 500 W Mddetown 925102 s( substation Juncilon 1B generator

.Qhs?

Jockson juncilon ironsformers GH2 109112 105102 1B-14

Unit 2

1. 4 230 kV bus _ 1B oux

- transformer Fig.1 Three Mile Island Switchyard -

6

l

,. l 3 L E R N rs. 289/97-007,-008,-010 ll 5555858> 15585888855858888855858888558888

. ......~..*:vestressamanzastanssunamannasso 11l l 7

gll j

~

< '!Il i llil 1 11ll l i i

El f l l Illi ! s A

llll l ill!  !

5 9

IIi  !

r ls l ir e xo 4 fE i '

I E w n.

4 l i 58 l g

l ll - E a

lit  ; -

i i L, i I Fig. 2 Dommant core damage sequence for LER Nos. 289/97-007, -008, -010.

7 b